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Abstract: A quantum random number generator (QRNG) can generate 
true randomness by exploiting the fundamental indeterminism of quantum 
mechanics. Most approaches to QRNG employ single-photon detection 
technologies and are limited in speed. Here, we experimentally demonstrate 
an ultrafast QRNG at a rate over 6 Gbits/s based on the quantum phase 
fluctuations of a laser operating near threshold. Moreover, we consider 
a potential adversary who has partial knowledge on the raw data and 
discuss how one can rigorously remove such partial knowledge with post- 
processing. We quantify the quantum randomness through min-entropy 
by modeling our system and employ two randomness extractors - Tre- 
visan's extractor and Toeplitz-hashing - to distill the randomness, which is 
information-theoretically provable. The simplicity and high-speed of our 
experimental setup show the feasibility of a robust, low-cost, high-speed 
QRNG. 
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1. Introduction 

Random numbers play a key role in many areas, such as statistical analysis, computer sim- 
ulations and cryptography lU-O. Traditionally, pseudo-random number generator (pseudo- 
RNG) based on deterministic algorithms has long been used for various applications. Recently, 
physical-RNG based on chaotic behaviors of semiconductor lasers has been proposed to gener- 
ate ultrahigh-speed random bits Generally speaking, the above schemes cannot generate 
truly random numbers with information-theoretically provable randomness. The output signal 
from a chaotic-laser system presents a property of periodicity due to the photon round 
trip time and the chaotic-laser system is essentially a deterministic system, which in principle 
cannot offer truly inherent randomness. We remark that very recently, fast physical-RNG using 
amplified optical noise has also been demonstrated ||7][8l. 

Quantum-RNG (QRNG), on the other hand, can generate truly random numbers from the 
fundamentally probabilistic nature of quantum processes. In the past decade, several QRNG 
schemes, such as single-photon detection ||9 HT3]| , quantum non-locality fMl . and vacuum state 
fluctuations ifTSll have been demonstrated. Meanwhile, commercial QRNGs such as ID Quan- 
tique system |fT6l have already appeared on the market. However, previous implementations 
have been limited to a relatively low rate due to the difficulties in measuring quantum effects: 
the speed of the single-photon-detection QRNG ||9 HT3]| is Umited by the maximum counting 
rate of single-photon detectors, which is typically below 100 MHz fTTl; quantum-non-locality 
QRNG 11411 is a proof-of-concept demonstration (with a random number generation rate on the 
order of 1 bit/s) and thus unsuitable for practical applications; building a fast shot-noise limited 
homodyne-detector for vacuum-state-fluctuations QRNG 1 15 1 is also a big challenge. In 2009, 
our group proposed and built a fast QRNG by measuring the quantum phase fluctuations (or 
noise) of a laser, which yields a speed of 500 Mb/s 118111911 . Instead of directly measuring weak 
quantum effects, this scheme measures the enhanced quantum noise (amplified spontaneous 
emissions) and thus can be realized by conventional photodetectors at a high-speed and with a 
low cost. A similar scheme at a lower speed has also been demonstrated ||20| . Nonetheless, the 
key point is, the generation rates of all previous QRNGs are still too low for many applications, 
such as high-speed quantum key distribution 121 J operating over GHz. 

Moreover in real experiments, the quantum randomness is inevitably mixed with the classi- 
cal noise, which may be observed or even controlled by a potential adversary. If we consider a 



scenario where the adversary tries to guess the outcomes from a QRNG, then she could take ad- 
vantage of the side information due to classical noise. Thus, a refined post-processing scheme is 
necessary to remove the correlation between the generated random bits and the classical noise. 
Two post-processing methods that are widely-used in various QRNG implementations are least- 
significant-bits (LSB) BH6I I20I and non-universal hashing functions 11 1II13|[T5| . It is impor- 
tant to perform such post-processing on the raw data to distill out a shorter, but more secure, 
string of random bits. However, neither LSB procedures nor non-universal hashing functions 
are information-theoretically provable, the property of which is especially valuable in current 
technology. Hence, it is still arguable whether these two methods can indeed extract out perfect- 
random bits. On the other hand, in theoretical computer science, there has been much interest in 
post-processing methods, called randomness extractors 11221541 . The randomness from many 
extractors has been information-theoretically proven, such as Trevisan's extractor 1231 . How- 
ever, none of these extractors have been implemented in a real QRNG experiment. Therefore, 
there is a gap between theory and experiment. 

In this paper, we report an ultrafast QRNG with a generation rate over 6 Gb/s based on 
measuring the quantum phase fluctuations of a laser operating at a low intensity level. Com- 
pared with our previous works 1181191 , both the hardware design and post-processing algorithm 
have been substantially improved. On the hardware side, a compact planar lightwave circuit 
Mach-Zehnder interferometer (PLC-MZI) with internal temperature control is introduced to 
replace the bulky MZI constructed with discrete fiber components in Ref. lfT8l[T9l . The high 
stability of the PLC-MZI allows us to stabilize its phase by simply controlling its temperature. 
We emphasize that the simple and robust design of our QRNG suggests that it can be readily 
commercialized for practical applications. 

On the post-processing side, we bridge the gap between the theory and practice of random- 
ness extraction by applying randomness extractors. Here, we quantify the quantum randomness 
and classical noise (present in the QRNG) separately by min-entropy. The min-entropy is de- 
fined as Hoo{X) = — log2 (max^gjo i}nPr[X = x]), which quantifies the amount of randomness 
of a distribution X on {0, 1 }". In our experiment, the min-entropy is evaluated by modeling the 
physical setup. We optimize the experimental parameters by maximizing the quantum random- 
ness and implement two randomness extractors, Trevisan's extractor l23l and Universal hashing 
(Toeplitz-hashing) [22 1. Both methods take finite-size effects into consideration. With this new 
post-processing scheme, we not only improve the random number generation rate 11811191 by 
more than one order of magnitude, but also achieve an information-theoretically provable ran- 
domness. It is the first QRNG experiment that implements such extractors. 

2. Experimental demonstration 

It is well known that the fundamental phase fluctuations (or noise) of a laser can be attributed 
to spontaneous emission, which is quantum mechanical by nature ll25l . The quantum phase 
fluctuations are inversely proportional to the laser output power f25\ . By operating the laser at a 
low intensity level, the quantum phase fluctuations can dominate over classical phase noise 1261 
and be readily extracted to generate truly random numbers. 

We have developed a delayed self-heterodyning system to measure the phase fluctuations. 
The schematic diagram of the experimental setup is shown in Fig.[T] A L55 jim single mode 
cw distribute-feedback (DFB) diode laser (ILX lightwave) operating at a low intensity level is 
the source of quantum phase fluctuations. A PLC-MZI with a 500ps delay difference (manu- 
factured by NTT) is employed to convert the phase fluctuations to intensity fluctuations, which 
is subsequently detected by a 5GHz InGaAs photodetector (Thorlabs). Note that to achieve a 
high interference visibility, a polarization maintaining fiber is used to connect the laser and the 
PLC-MZI. A temperature controller (TC) l27l is used to stabilize the phase difference of PLC- 



MZI. The photodetector output is further sampled and digitized by an 8-bit analog-to-digital 
convertor (ADC) to generate random bits. 
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Fig. 1. Experimental setup. Laser, 1550nm cw DFB laser diode (ILX Lightwave); PLC- 
MZL planar lightwave circuit Mach-Zehnder interferometer with a 500ps delay difference 
(manufactured by NTT); TC, temperature controller (PTC 5K from Wavelength Electronics 
Inc.); PD, 5GHz InGaAs photodetector (Thorlabs SIR5-FC); ADC, 8-bit analog-to-digital 
convertor inside an oscilloscope (Agilent DSO81204A). 



The electric field of the DFB laser beam is given by 

E{t)^Eoexp[i{cot + eit))] (1) 

where 0{t) represents the phase fluctuations of the laser source and (O is angular frequency. 
By stabilizing the phase difference of PLC-MZI (the phase delay introduced by the path length 
difference of the two arms) at [2mn + 7i/2] (where m is an integer), the output voltage V{t) 
from the photodetector (after removing a DC background) can be described by 12511281 

V{t) oc 2E{t)E{t + t) sin(A0(f )) oc PA0(f ) (2) 



where P is the laser output (emission) power, T = SQQps is the constant time delay between the 
two arms of our PLC-MZI, and A0 (f ) = (f ) — (f + t) is the total phase fluctuations measured 
by the interferometric system. Strictly speaking, A0 is a function of both t and T. Since T is a 
constant in our system, we treat AQ as a function of t for simplicity. Here, A0(f) is sufficiently 
small such that sin(A0(f)) ?» A0(f). We have assumed that the intensity noise of the laser is 
negligible |25 1, which has been verified experimentally (see discussion below). 

It is convenient to further separate the total phase fluctuations (measured by the system) into 
a quantum part and a classical part. While the quantum phase fluctuations are inversely propor- 
tional to laser output power and can be treated as Gaussian white noise 1281, the classical phase 
noise is laser-power independent 1291 , which in principle could be controlled by a potential 
adversary. Hence, the variance of the total phase fluctuations can be written as 

{Ae{tf) = ^+C (3) 

where (•) denotes a statistical average, 2 and C represent the contributions of quantum phase 
fluctuations and classical phase noise respectively. We remark that within the time scale of our 
experiment, Q, P and C do not vary with time. 

In practice, the detection system will also contribute a laser-power independent background 
noise F. Therefore, the variance of the output a.c. voltage Vp, (0 from the photodetector of our 
system is given by 

{Vpr{tf)^AQP+ACP^ + F (4) 
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Fig. 2. Experimental voltage variance. The variance of the output a.c. voltage (Vpr{t)) from 
the photodetector (see Fig. [Hi is measured by an oscilloscope. Here, the error bars are 
smaller than the symbol size. The experimental data is fitted by a quadratic polynomial 
function. 

where A is is a constant determined by the gain of the photodetector. 

In Eq. (|4|l, the term AQP is quantum fluctuations part, from which true randomness can be 
extracted. We name it quantum signal. On the other hand, the term ACP^ + F quantifies clas- 
sical noise due to technical imperfections that potentially could be controlled by an adversary. 
In principle, the amount of extractable quantum randomness is independent of the magnitude 
of classical noise. However in practice, it is challenging to extract a small quantum signal on 
top of a large classical noise background. To generate high-quality random numbers, we would 
like to maximize the quantum signal while keeping the classical noise as low as possible. 

One common figure of merit in signal processing is the signal-to-noise ratio (SNR). In our 
QRNG system, SNR 7 can be defined as 

r=-^ (5) 

^ ACP^ + F ^' 

Given parameters AQ, AC, and F, we can choose a suitable laser power P to maximize 7. 

To determine the parameters AQ, AC, and F experimentally, we measured the variance of 
Vpr{t) at different optical power levels (see Fig. O and then fit the experimental data (with 
least square estimation fitting) using Eq. (|4]i. The experimental results and the corresponding 
confidence intervals (level a = 0.99) are shown in Table[T] 

Table 1. Experimental results (with 0.99 confidence intervals) of parameters in Eq. l|4j. 
F (mV^) AQ {mV-/mW) AC (mV^/mW^) 

0.36±0.06 16.1 ±0.5 0.4±0.2 



Using Eq. Q and the data given in Table [T] we calculate 7 as a function of laser power The 
results are shown in Fig. [3] The experimental data points are determined with an oscilloscope 
at different laser power levels (see details in Ref. 1301 ). We can see that at low and high power 
range, either the background noise F or the classical phase noise ACP- will dominate over the 
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Fig. 3. Quantum signal to classical noise ratio. The theoretical curve of signal-to-noise ratio 
is obtained from Egn.[5]and the parameters given in Table [T] The experimental results are 
measured with an oscilloscope at different laser powers 1301 (the corresponding error bars 
are smaller than the symbol size). At low and high power range, either the background noise 
F or the classical phase noise ACP^ will dominate over the quantum signal. The optimal 
ratio 7=21 is achieved at P = 0.95 mW . 

quantum signal. The optimal ratio 7 = 21 is achieved at P = 0.95 mW . As shown in Ref. ISTI . 
by operating the laser at this power, the extractable quantum randomness is also maximized. 
Therefore, we choose 0.95 mW as the working point of laser. 

We also perform measurements in the frequency domain by using an RF spectrum analyzer. 
Three different power-spectra have been acquired; (1) the spectrum of total phase fluctuations 
under the optimal working condition (0.95 mW); (2) the intensity noise spectrum acquired by 
connecting the laser output directly to the photodetector; (3) the background noise spectrum 
acquired by turning off the laser The results are shown in Fig. ID We can see that under the 
normal operating condition, the intensity noise is negligible compared to the phase fluctuations. 
This result supports our previous assumption. Note that since the PLC-MZI is a fiber-pigtailed 
compact device, we expect that the coupling efficiency between the laser and the PLC-MZI 
will stay constant over time. As we expect from a perfect white noise source, the spectrum of 
phase fluctuations itself is flat over the whole measurement frequency range. In the spectrum of 
background noise, there are a few spectral lines that could be environmental EM noise picked 
up by our detector lf32l . 

The experimental procedure for random number generation is as follows. The laser output 
power is set to 0.95 mW by adjusting its driving current. The TC is carefully adjusted to stabilize 
the phase difference of PLC-MZI at \lmK-\- n/2]. The output a.c. voltage (Vpr(f)) from the 
photodetector is sampled and digitized at 1 GHz sampling rate 1331 with an 8-bit ADC. The 
sampling range of ADC is determined by the peak-to-peak voltage of Vp, (f) (around 30 mV) 
ll34l and the bins of ADC are equally spaced. Thus, from each sample point, we can generate 8 
raw random bits that are ready for post-processing. 

3. Min-entropy evaluation 

As mentioned earlier, the raw random bits from our QRNG are contributed by both the quantum 
signal and the classical noise. In order to remove the correlation between the random bits and 
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Fig. 4. Noise spectra. The spectral power density of total phase fluctuations (blue), intensity 
noise (green), and background noise (red). 



the classical noise (and thus extract pure quantum randomness), we apply a post-processing 
scheme that is composed of two main parts - quantum min-entropy (or randomness) evaluation 
and randomness extraction. The evaluation of min-entropy is discussed in this section, while 
randomness extraction will be described in the following section. 
Min-entropy is defined as 



H^{X) = -\og2 



max Pr\X 
xe{o,i}" 



(6) 



It quantifies the amount of randomness of a distribution X on {0, 1}". From Eq. Q, the min- 
entropy of a given sequence X is determined by the sample point x with maximal probability 
Pmux = maXj-gjo 1}" Pr\X =x\. A simple illustration of the evaluation process is shown in Fig.|5] 
where the raw-data follows a Gaussian distribution and is digitized by a 3-bit ADC. Hence, 
the raw-data will be mapped to a binary sequence X with 3 dimensions (n=3 in Eq. (|6])). The 
sample point (one of the 8 bins in Fig.|5]) with maximal probability is 'Oil' (or '100') and its 
corresponding probability P,nax can be calculated from its bin area. Note that in Fig. |5] three 
key parameters to determine Pmax (thus min-entropy) are the standard deviation of Gaussian 
distribution (a), the ADC sampling range (a) and the resolution of ADC (3-bit in Fig|5]i. 

In our experiment, a physical model is derived to evaluate the quantum min-entropy of the 
raw-data. Our main assumptions are: ( 1 ) Quantum signal is independent of classical noise when 
the laser is operating above threshold; (2) Quantum signal follows a Gaussian distribution 1281 : 
(3) The sequence of the raw-data is independent and identically distributed (iid. See 1331 and 
discussion below). 

With these assumptions, we can calculate the quantum min-entropy of the raw-data as fol- 
lows. 



1. Determine the sampling range and evaluate the total variance: the working range of sam- 
pling system (8-bit ADC in Fig.[r|i a is determined by the output voltage from the pho- 
todetector (Vp, (f ) in Eq. From random sampling, we can obtain the variance of the 
total fluctuations, <7,^„^/ ^ AQP + ACP^ + F . At the laser emission power 0.95 mW, we 



Fig. 5. A simple illustration of min-entropy evaluation (toy model). The raw-data follows a 
Gaussian distribution (fl =0 and a = 7) and is digitized by a 3-bit ADC (sampling range 
is defined as [-a, a] with a=15 here). From Eq. (|6}, the min-entropy is determined by the 
sample point x with the maximal probability Pmax- Here, x equals to the bin of '100' (or 
'OH') and Pmax can be calculated from its bin area. 

choose the ADC sampling range as a = 15 mV and obtain the variance of the total fluc- 
tuations as ct,^(q; = 24-AmV^. 

2. Evaluate signal to noise ratio: from Fig. [3] we evaluate the quantum signal to classical 
noise ratio. At 0.95 mW, the ratio is 7 = 21. 

3. Evaluate the quantum variance: from Eq. ^ and step 1 and 2, we can calculate the 
variance of the quantum signal (following a Gaussian distribution) as AQP. At 0.95 mW, 
the quantum variance is (y^„antum = ^^Lai = 23.3my^. 

4. Calculate the lower bound of the quantum min-entropy: as shown in Fig. |5] given the 
ADC range a, we evaluate the bin with maximal probability from the Gaussian distribu- 
tion derived in Step 3, which gives the lower bound of the min-entropy of the quantum 
signal. Note that in real experiment we use an 8 -bit ADC (instead of 3 -bit in Fig.|5]i and 
its bins are equally spaced. At 0.95 mW, the standard deviation of the Gaussian distribu- 
tion is Gqucmtiim = 4-8 mV and the corresponding maximal probability of the raw sequence 
is Pmax = 9.6 X 10^^. Therefore, from Eq. (|6]l, the quantum min-entropy of our raw-data 
is 6.7 bits per sample (8 raw bits from the ADC in Fig.[Tli. 

One might ask 'whether the randomness generation rate is bounded by the channel capac- 
ity 1351 of a noisy channel through the signal-to-noise ratio?' In our opinion, the answer is no. 
The main function of a QRNG is not to recover the quantum signal (source of quantum random- 
ness) from the background of the classical noise, but to generate random bits which have no 
correlations with the classical noise. We can assume that our quantum signal ultimately gives 
us a classical number X (random number generation) and the adversary (Eve) inputs a classical 
number E (by controlling the classical noise). X and E are combined together to obtain the raw 
output Y. Hence, the whole discussion can be phrased within classical information theory. For 
instance, we can consider the discrete case and the simple function that Y is the exclusive-or of 
X and E. Suppose X and E are both one random bit, then the output Y will also be random and 
the conditional entropy H{Y\E) is 1 bit, where Eve has no information about Y. On the other 



hand, since Eve can decide whether to flip the bit or not, the mutual information between X and 
Y is I{X :Y) = 0. The channel capacity is zero. In summary, this simple example shows that it is 
possible for the randomness generation (i.e. X = I bit) to be non-zero even though the channel 
capacity is zero. The channel capacity is not an upper bound to the randomness generation rate. 

4. Randomness extraction and statistical tests 

In previous section, we have shown that the lower bound of quantum min-entropy is 6.7 bits 
per sample, which means that we can generate 6.7 information-theoretically random bits from 
each sample (8 raw bits). We remark that the raw-data itself cannot pass the statistical random 
tests, which is mainly due to the classical noises mixed in the raw-data and the fact that the 
as-obtained quantum phase fluctuations follow a Gaussian distribution instead of an uniform 
distribution. Therefore, to extract the 6.7 perfect-random bits and improve the randomness 
quality of our raw-data, randomness extractor is implemented. Roughly speaking, a random- 
ness extractor is a function as 

{0,l}"x{0,ir'^{0,l}'« (7) 

which means that for a raw and non-perfect-random sequence X on {0, 1}" with min-entropy 
Hoo{X) > m, the extracted output sequence F is a nearly uniform distribution on {0, 1}'". In 
other words, a randomness extractor takes a small random seed (d bits) and a raw random 
source (« bits) and outputs a near perfect-random bit-string (m bits). A more rigorous discussion 
of randomness extractor can be found in lISTI . 

We implement two randomness extractors, Toeplitz-hashing extractor 1221 and Trevisan's 
extractor 123)1 . Both are proven to be information-theoretically secure and take finite-size effects 
into account l36l . The details of our implementation are discussed in Ref. l3T]| . Here, we give a 
brief summary. Toeplitz-hashing extractor extracts random bit-string m by multiplying the raw 
sequence n with the Toeplitz matrix (n-hy-m matrix, random seed). The seed length of random 
bits required to construct the Toeplitz matrix is d ~n + m—l |37||. In our implementation with 
Matlab on a standard laptop computer, we choose the input bit-string length as « = 4096. Since 
the min-entropy of our raw-data is 6.7 bits per 8-bit sample, the output bit-string is 4096 x 
6.7/8 > 3430. To generate near perfect-random bits, the output length is set to m = 3230 bits 
(see OTI ). Hence, a 4096-by-3230 Toeplitz matrix is generated l38l in construction of the 
Toeplitz-hashing extractor, which achieves a speed of 441 Kb/s. Note that Toeplitz-hashing can 
be implemented much faster with hardware implementations l37l . For Trevisan's extractor, we 
implement its improved version l39l and the details are shown in 1311 . 

The output from both extractors successfully passes all the standard statistic tests of Diehard 
l40l . NIST mi, and TestUOl El. The autocorrelations of the raw-data and the ToepHtz- 
hashing output are shown in Fig. |6(a)| and Fig. |6(b)| Here, the autocorrelation coefficient R 
of a sequence X is defined as 

^^.^^Em-,)ix.,,-,)] 

where E [•] is the expected value operator, j is the sample delay (or shift), pi and a are the mean 
and the standard deviation of X. Figure [6(a)| shows the autocorrelation results of our raw-data. 
The low values of the autocorrelation between raw samples (8-bit per sample) verify the iid 
assumption of our physical model for min-entropy evaluation (see assumption 3 in Section[3]). 
A slightly large coefficient at the 2nd delay sample is attributed to the finite bandwidth of our 
photodetector After post-processing, the autocorrelation is substantially reduced as shown in 
Fig.M 



Some test results of the extracted data are given in Fig. |6(c)| and Fig. |6(d)| With the sampling 
rate of 1 GHz, the corresponding random bit generation rate is over 6 Gb/s. We finally remark 
that our implementations of randomness extractors with Matlab on a standard PC are not fast 
enough for a real-time QRNG. In practice, this might restrict the random bit generation speed. 
It will be interesting for future investigations to create a real-time extractor (by a better software 
or hardware implementation) for our high-speed QRNG. 
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Fig. 6. (a) Autocorrelation of the raw-data. The raw-data is obtained by sampling the 
output a.c. voltage (Vpr{t) from the photodetector) with an ADC (see Fig.lTJ. Each sample 
consists of 8 bits and the correlation between samples cannot reach zero for a practical 
detector with finite bandwidth, (b) Autocorrelation of the Toeplitz-hashing output. Data 
size is 1 X 10^ bits and the average value within 100 bit-delay is —1.0 x 10^^. In theory, for 
a truly random 1 x 10^ bit string, the average normalized correlation is and the standard 
deviation is 3 x 10^^. In practice, due to the inevitable presence of bias and finite data size, 
the autocorrelation of data sequence can never reach 0. (c) NIST results of the Toeplitz- 
hashing output. Data size is 3.25 Gbits (500 sequences with each sequence around 6.5 
Mbits). To pass the test, P-value should be larger than the lowest significant level a = 0.01, 
and the proportion of sequences satisfying P > a should be greater than 0.976. Where the 
test has multiple P-values, the worst case is selected, (d) Diehard results of the Trevisan's 
extractor output. Data size is 240Mbits. A Kolmogorov-Smirnov (KS) test is used to obtain 
a final P-value from the case of multiple P-values. Successful P-value is 0.01 < P < 0.99. 



5. Conclusion 



In conclusion, we have successfully demonstrated a high-speed QRNG at a generation rate of 
over 6 Gb/s. The randomness is generated from the intrinsic quantum phase fluctuations of 



spontaneous emission photons. Our work not only highlights the importance on the rigorous 
quantification and distillation of the quantum randomness in a practical QRNG, but also 
demonstrates the large potential for random number generations by quantum phase fluctuations 
as the true entropy source. 
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